Short answer
Under Directive 2009/24/EC, source code, object code and qualifying preparatory design material are protected as computer programs when they are the author's own intellectual creation. Copyright protects the program's original expression, not its underlying ideas and principles. Functionality, programming languages and data-file formats are not, as such, protected as program expression, although particular materials such as a manual or graphical interface may separately qualify as works under general copyright law.
The rightholder normally controls reproduction, alteration and distribution. A lawful acquirer may, within defined limits, perform acts necessary for intended use and error correction, make a necessary backup, and observe, study or test a program while carrying out acts that person is entitled to perform. Decompilation is permitted where indispensable to obtain otherwise unavailable information needed for interoperability with an independently created program, subject to strict limits on who acts, what code is examined and how the information is used. The Court has also held that necessary decompilation may be used to correct an error, under the separate lawful-use exception.
These are conditional exceptions, not a general entitlement to copy source code, bypass access controls, clone expressive code or publish decompiled material.
Copyright protects expression, not software ideas
The Software Directive treats computer programs as literary works and defines both the threshold and boundary of protection:
Protection in accordance with this Directive shall apply to the expression in any form of a computer program. Ideas and principles which underlie any element of a computer program, including those which underlie its interfaces, are not protected by copyright under this Directive. A computer program shall be protected if it is original in the sense that it is the author's own intellectual creation. —
Source and object code are program expression. Preparatory design material also qualifies if capable of leading to a program. No additional merit or quality test applies.
The boundary matters when a competitor independently implements compatible behaviour. In SAS Institute, Case C-406/10, the Court held:
[N]either the functionality of a computer program nor the programming language and the format of data files used in a computer program in order to exploit certain of its functions constitute a form of expression of that program and, as such, are not protected by copyright in computer programs. —
That does not permit literal or partial copying of protected code. Nor does it mean that every related element is unprotected. In BSA, Case C-393/09, the Court held that a graphical user interface is not program expression under the Software Directive because it does not enable reproduction of the program, but it may be protected as a work under Directive 2001/29/EC if original. SAS Institute similarly recognised that a manual, language-related material or data format might contain separately protected original expression under general copyright law.
Reproduction and alteration normally require permission
Article 4 gives the rightholder control over permanent and temporary reproduction, including copies necessarily made by loading, displaying, running, transmitting or storing the program. It also covers translation, adaptation, arrangement and other alteration, reproduction of the result, and public distribution of copies.
The starting question is therefore not merely whether someone “copied the software”. Running, modifying or translating code may involve a restricted act. Articles 5 and 6 then determine whether a specific statutory permission applies.
Observation, study and testing do not require source-code access
A person entitled to use a copy may investigate how it behaves:
The person having a right to use a copy of a computer program shall be entitled, without the authorisation of the rightholder, to observe, study or test the functioning of the program in order to determine the ideas and principles which underlie any element of the program if he does so while performing any of the acts of loading, displaying, running, transmitting or storing the program which he is entitled to do. —
In SAS Institute, the licensee had no source-code access and did not decompile the object code. It studied program behaviour and wrote a second program implementing the same functionality. The Court confirmed that Article 5(3) protected observation carried out through licensed acts and loading or running necessary for use, provided the rightholder's exclusive rights were not infringed.
The permission is not authority to copy code, a protected manual or other original expression. A contractual term that contradicts Article 5(3) is null and void under Article 8.
Interoperability decompilation has narrow conditions
Article 6 permits code reproduction and translation only where they are indispensable to obtain information needed for interoperability between an independently created program and other programs. The acts must be performed by a licensee or another person entitled to use a copy, or on that person's behalf; the information must not already be readily available; and the work must be confined to necessary parts.
The authorisation of the rightholder shall not be required where reproduction of the code and translation of its form [...] are indispensable to obtain the information necessary to achieve the interoperability of an independently created computer program with other programs. —
Information obtained through this route may not be used for other goals, disclosed except where necessary for interoperability, or used to develop, produce or market a program substantially similar in its expression. The exception also cannot be applied in a way that unreasonably prejudices legitimate interests or conflicts with normal exploitation. Contract terms contrary to Article 6 are null and void.
Error correction can include necessary decompilation
Article 5(1) separately permits a lawful acquirer, absent specific contractual arrangements, to reproduce or alter a program where necessary for intended use, including error correction. In Top System, Case C-13/20, the Court rejected the argument that all lawful decompilation must satisfy the interoperability conditions:
[T]he lawful purchaser of a computer program is entitled to decompile all or part of that program in order to correct errors affecting its operation, including where the correction consists in disabling a function that is affecting the proper operation of the application of which that program forms a part. —
The decompilation must be necessary. It is not necessary where the source code is lawfully or contractually accessible. The parties cannot contractually eliminate every possibility of error correction, but may arrange how correction will occur—for example, by assigning maintenance to the rightholder. Decompiled code may be used only as required for the correction, not distributed or reused for another purpose.
Backup copies and technical protection remain separate
A person with a right to use the program may make a backup where necessary for that use, and a contract cannot prevent that backup. This does not authorise an archive of unlimited copies or a copy retained for an unrelated use.
Anti-circumvention rules require a separate analysis. Article 7 of the Software Directive requires remedies against commercially circulating or possessing a means whose sole intended purpose is to facilitate unauthorised removal or circumvention of a technical device protecting a program. Where a product combines code with other protected material, Directive 2001/29 may also matter. In Nintendo, Case C-355/12, concerning videogames, the Court required national courts to examine whether protection measures are proportionate, including less restrictive alternatives and the actual uses of circumvention devices. A right to test or repair does not automatically authorise bypassing every access control.
New repair and cybersecurity rules do not rewrite these exceptions
National measures implementing Directive (EU) 2024/1799 apply from 31 July 2026. For goods covered by specified EU repairability legislation, Article 5(6) restricts unjustified contractual, hardware or software techniques that impede repair, while preserving intellectual-property law. It does not create a general right to copy or decompile software.
The Cyber Resilience Act, Regulation (EU) 2024/2847, adds vulnerability-handling and security-update duties for products with digital elements. Its conformity-assessment-body chapter applies; reporting starts on 11 September 2026 and general application on 11 December 2027. Those product duties do not expand the Software Directive's copyright exceptions.
A practical classification
Before acting, identify:
- the protected material—code, preparatory design, interface, manual, data or unprotected functionality;
- whether the actor is a lawful acquirer or otherwise has a right to use the copy;
- the restricted reproduction or alteration that the proposed act entails;
- whether the purpose is intended use, backup, observation, error correction or interoperability;
- whether the act and its scope are necessary, and whether the information was already available;
- what the licence validly regulates and which contrary terms are null; and
- whether technical-protection, trade-secret, contract, security or sector-specific repair rules independently apply.
Conclusion
EU law protects original software expression without granting ownership of functionality, ideas or principles. It preserves room for legitimate use, behavioural study, necessary backups, error correction and independently created interoperability, but attaches a different legal test to each. The safest analysis classifies the material, actor, act, purpose and technical method separately; a permitted purpose does not excuse copying or disclosure beyond what its exception requires.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.